CVE-2026-33976

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33976", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-24T22:20:06.210Z", "datePublished": "2026-03-27T21:26:10.127Z", "dateUpdated": "2026-04-03T03:55:22.486Z"}, "containers": {"cna": {"title": "Notesnook vulnerable to RCE via stored XSS in Web Clipper rendering", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.7, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/streetwriters/notesnook/security/advisories/GHSA-f42f-phvp-43x5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/streetwriters/notesnook/security/advisories/GHSA-f42f-phvp-43x5"}], "affected": [{"vendor": "streetwriters", "product": "Notesnook Web/Desktop", "versions": [{"version": "< 3.3.11", "status": "affected"}]}, {"vendor": "streetwriters", "product": "Notesnook iOS/Android", "versions": [{"version": "< 3.3.17", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-27T21:26:10.127Z"}, "descriptions": [{"lang": "en", "value": "Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering flow can be escalated to remote code execution in the desktop app. The root cause is that the clipper preserves attacker-controlled attributes from the source page\u2019s root element and stores them inside web-clip HTML. When the clip is later opened, Notesnook renders that HTML into a same-origin, unsandboxed iframe using `contentDocument.write(...)`. Event-handler attributes such as `onload`, `onclick`, or `onmouseover` execute in the Notesnook origin. In the desktop app, this becomes RCE because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Version 3.3.11 Web/Desktop and 3.3.17 on Android/iOS patch the issue."}], "source": {"advisory": "GHSA-f42f-phvp-43x5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-31T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-33976"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-03T03:55:22.486Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33976", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-30T15:38:44.848839Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T15:38:52.437Z"}}], "cna": {"title": "Notesnook vulnerable to RCE via stored XSS in Web Clipper rendering", "source": {"advisory": "GHSA-f42f-phvp-43x5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.7, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "streetwriters", "product": "Notesnook Web/Desktop", "versions": [{"status": "affected", "version": "< 3.3.11"}]}, {"vendor": "streetwriters", "product": "Notesnook iOS/Android", "versions": [{"status": "affected", "version": "< 3.3.17"}]}], "references": [{"url": "https://github.com/streetwriters/notesnook/security/advisories/GHSA-f42f-phvp-43x5", "name": "https://github.com/streetwriters/notesnook/security/advisories/GHSA-f42f-phvp-43x5", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering flow can be escalated to remote code execution in the desktop app. The root cause is that the clipper preserves attacker-controlled attributes from the source page\u2019s root element and stores them inside web-clip HTML. When the clip is later opened, Notesnook renders that HTML into a same-origin, unsandboxed iframe using `contentDocument.write(...)`. Event-handler attributes such as `onload`, `onclick`, or `onmouseover` execute in the Notesnook origin. In the desktop app, this becomes RCE because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Version 3.3.11 Web/Desktop and 3.3.17 on Android/iOS patch the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-27T21:26:10.127Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33976", "state": "PUBLISHED", "dateUpdated": "2026-04-03T03:55:22.486Z", "dateReserved": "2026-03-24T22:20:06.210Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-27T21:26:10.127Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Notesnook Web/Desktop", "vendor": "streetwriters", "versions": [{"status": "affected", "version": "< 3.3.11"}]}, {"product": "Notesnook iOS/Android", "vendor": "streetwriters", "versions": [{"status": "affected", "version": "< 3.3.17"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:streetwriters:notesnook_desktop:*:*:*:*:*:*:*:*", "matchCriteriaId": "08C11EDB-67C1-4E85-A07D-0164CB036757", "versionEndExcluding": "3.3.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:android:*:*", "matchCriteriaId": "105C802D-D317-4B9A-B883-D07A1E0840E6", "versionEndExcluding": "3.3.17", "vulnerable": true}, {"criteria": "cpe:2.3:a:streetwriters:notesnook_mobile:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "858B01C2-38C3-4093-A638-E380119ABDF5", "versionEndExcluding": "3.3.17", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering flow can be escalated to remote code execution in the desktop app. The root cause is that the clipper preserves attacker-controlled attributes from the source page\u2019s root element and stores them inside web-clip HTML. When the clip is later opened, Notesnook renders that HTML into a same-origin, unsandboxed iframe using `contentDocument.write(...)`. Event-handler attributes such as `onload`, `onclick`, or `onmouseover` execute in the Notesnook origin. In the desktop app, this becomes RCE because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`. Version 3.3.11 Web/Desktop and 3.3.17 on Android/iOS patch the issue."}, {"lang": "es", "value": "Notesnook es una aplicaci\u00f3n para tomar notas. Antes de la versi\u00f3n 3.3.11 en Web/Escritorio y 3.3.17 en Android/iOS, un XSS almacenado en el flujo de renderizado de Web Clipper puede escalarse a ejecuci\u00f3n remota de c\u00f3digo en la aplicaci\u00f3n de escritorio. La causa ra\u00edz es que el clipper preserva atributos controlados por el atacante del elemento ra\u00edz de la p\u00e1gina de origen y los almacena dentro del HTML del web-clip. Cuando el clip se abre posteriormente, Notesnook renderiza ese HTML en un iframe de mismo origen y sin sandbox usando \u2019contentDocument.write(...)\u2019. Atributos de gestor de eventos como \u2019onload\u2019, \u2019onclick\u2019 o \u2019onmouseover\u2019 se ejecutan en el origen de Notesnook. En la aplicaci\u00f3n de escritorio, esto se convierte en RCE porque Electron est\u00e1 configurado con \u2019nodeIntegration: true\u2019 y \u2019contextIsolation: false\u2019. La versi\u00f3n 3.3.11 Web/Escritorio y 3.3.17 en Android/iOS parchean el problema."}], "id": "CVE-2026-33976", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33976", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-31T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-27T22:16:22.250", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/streetwriters/notesnook/security/advisories/GHSA-f42f-phvp-43x5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.3.17)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Notesnook iOS/Android", "source": "cna", "vendor": "streetwriters"}, "product": "notesnook_ios/android", "vendor": "streetwriters"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.3.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Notesnook Web/Desktop", "source": "cna", "vendor": "streetwriters"}, "product": "notesnook_web/desktop", "vendor": "streetwriters"}], "analysis": {"en": {"generated_at": "2026-03-31T19:40:51.378130+00:00", "value": {"mitigation_remediation": ["Apply the latest update to Notesnook Web/Desktop (version\u202f3.3.11 or newer).", "Apply the latest update to Notesnook Android/iOS (version\u202f3.3.17 or newer).", "Verify that all users have updated to the patched versions to eliminate the attack surface."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected products are streetwriters\u2019 Notesnook Web/Desktop and the mobile iOS/Android apps. All pre\u2011update releases before version\u202f3.3.11 on the Web/Desktop build and before version\u202f3.3.17 on the Android/iOS builds are vulnerable. The patches that fix the issue are released as 3.3.11 for Web/Desktop and 3.3.17 for Android/iOS.", "description_and_impact": "Notesnook, a note\u2011taking application, had a stored cross\u2011site scripting flaw in its Web Clipper rendering flow that can be elevated to full remote code execution on the victim\u2019s machine. The clipper accepts attacker\u2011controlled attributes from the original page\u2019s root element and stores them in the generated clip HTML. When the clip is later opened, Notesnook writes that HTML into an unsandboxed iframe with the same origin using\u202fcontentDocument.write. Any event\u2011handler attributes\u2014such as onload, onclick, or onmouseover\u2014execute in the Notesnook origin. On desktop, the Electron runtime is configured with nodeIntegration set to true and contextIsolation set to false, so the injected code gains full access to the host system, resulting in complete compromise.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 9.7, indicating critical severity, while the EPSS score is below 1\u202f%, suggesting a low likelihood of active exploitation within the current threat landscape. Notesnook is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious page to a victim\u2019s Web Clipper; the victim must then open the stored clip, at which point the unsandboxed iframe runs the injected code with full Electron privileges, enabling remote code execution."}}}}, "created": "2026-03-29T20:29:39.879095+00:00", "updated": "2026-03-31T20:00:37.037093+00:00", "vendors": ["streetwriters", "streetwriters$PRODUCT$notesnook_ios/android", "streetwriters$PRODUCT$notesnook_web/desktop"]}